Invalid ViewState

July 16, 2005 • 27 comments

On this page:

I’ve been working with a customer who is working with my application as a typical end user would. This means, they often use the browser in ways the application isn’t meant to be used <g>. If you want to translate that: It means they use the BACK button a lot.

One of my application pages is fairly complex and it contains about 50 fields or so which are displayed with a tabbed display and used to display inventory data.

I’ve been getting a ton of Invalid Viewstate errors which looks like this in my error log:

/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

Invalid_Viewstate

Client IP: 68.116.115.30

Port: 47723

User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/312.1 (KHTML, like Gecko) Safari/312

ViewState: dDwtMTc0Nzg0MDU5OztsPFd3d2ViY2hlY2tib3gxO3R4dG5vd2ViO1d3d2ViY2hlY2tib3gyOz4+wsDm0DO4DrTgsEuGylUVMawoGG0=

Http-Referer: http://www.kidswhorip.com/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

Path: /store/admin/EditInventoryItem.aspx.

on 7/17/2005 12:10:52 am

--- Stack Trace ---

at System.Web.UI.Page.LoadPageStateFromPersistenceMedium()

at System.Web.UI.Page.LoadPageViewState()

at System.Web.UI.Page.ProcessRequestMain()

--- Request Information ---

Full Url: http://www.kidswhorip.com/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

IP: 68.116.115.30

Referer: http://www.kidswhorip.com/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

Browser: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/312.1 (KHTML, like Gecko) Safari/312

Locale: en

--- Raw Post Buffer ---

__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=dDwtMTc0Nzg0MDU5OztsPFd3d2ViY2hlY2tib3gxO3R4dG5vd2ViO1d3d2ViY2hlY2tib3gyOz4%2BwsDm0DO4DrTgsEuGylUVMawoGG0%3D&txtsku=KWR_TSHIRT_BW_ORANGE&txt _EditTabs=Detail

... additional data removed for brevity

I’ve seen the errors happening on the user’s browser configuration but no matter how I try here I can’t duplicate a repeatable scenario.

What’s even worse is that this page has ViewState disabled – my app doesn’t need or use it, so the viewstate used is only in use for ASP.NET internally.

After some more searching I ran intot he following KB Article:

Intermittent Invalid Viewstate Error in ASP.NET Web pages

This article suggests that the error might occur because of Application Pool cycling. The solution to this problem is to set a flag in machine.config to prevent ASP.NET to generate a new key everytime an Application starts.

I tried to get this to fail, simply by restarting IIS, but that didn’t do it for me – I got no failure, so I’m still not quite sure what is causing the Invalid ViewState scenario to occur.

The first thing I’m trying right now is to set EnableViewStateMac=”false” in the page and see if that helps. I suspect this will fix the problem, but I’d still like to know why the validation is failing on the host server.

The Voices of Reason

TP
July 17, 2005

# re: Invalid ViewState

I have also seen the invalid view state error when loading user controls dynamically. We never really solved this problem because it occurred so seldom. We had followed all of the recommendations from MSDN but it never truly solved the problem.

When the error occurred it always happened on the same page and the same asp.net event.

The patch that was offered to help track down the problem caused more problems because it broke other asp.net applications, not sure why.

Fabio Vazquez
July 19, 2005

# re: Invalid ViewState

Hi Rick,

I had a similar problem in an environment using clustered machines. It seemed that the user was getting responses from different machines of the cluster, so the ASP.NET was thinking that the viewstate data was corrupted. Setting EnableViewStateMac=”false” solved the problem, but the real solution was actually change the <MachineKey> element to use the same hash generation key on both machines of the cluster.

I don't know if this scenario applies to your case, but it was really the problem that bothered me for some days.

Dave A
July 20, 2005

# re: Invalid ViewState

Rick,

I get this all of the time when someone is visiting one of my large webapplication sites using Pocket IE. This is not uncommon since the web site integrates with the PPC using SOAP and so a user will often log on to see the data that they have collected.

It has not yet become important enough to warrent further investigation - I have just been putting it down to PIE being buggy.

Rick Strahl
July 20, 2005

# re: Invalid ViewState

Just an update - turning EnableViewStateMac off on the page fixed the problem as far as I can see. I'm not to worried about Viewstate hacking, so I'm going to try and turn this off at least on all of the admin backend pages. It still sucks that this is happening

Tim Farley
July 22, 2005

# Another way to fix the pooling/cycling problem

Instead of stting EnableViewStateMac=false, I think you can solve this a different way: generate a specific crypto key for your application to use and put it in the <machineKey> section of your web.config. That way, even if the application cycles, it will come back using the same crypto key.

Rick Strahl
July 22, 2005

# re: Invalid ViewState

Right, I mentioned that, but because this app is running at an ISP I don't have control over the machinekey.

Morgan Belford
July 29, 2005

# re: Invalid ViewState

Safari, through version 2.0, has a problem with ViewState. In our experience, when you open a window using javascript (e.g., window.open), the page you open to, or sometime the next page, can have the following problem: when you submit a postback from that page, the browser sends the viewstate (__VIEWSTATE) from a previous form (on a previous page).

Specifically, in Safari only:
1. window.open("page1.aspx")
2. page1.aspx has form with __VIEWSTATE
3. Do normal hyperlink from page1.aspx to page2.aspx (i.e, don't do a postback)
4. On page2.aspx, perform an operation that does a postback
5. See viewstate error -- we note that the viewstate sent to the server was from the form in page1.aspx, not page2.aspx.
6. If you put an alert at the bottom of page2.aspx, to display __VIEWSTATE from forms[0], you will see the viewstate of the previous page's form, but if you do a view source of page2.aspx, you will see the correct view state.

We are doing no server transfers or anything like that.

In Safari 1.0, but no longer, we saw the same problem, in the case where step 3 was replaced by page1.aspx emitting javascript that caused an immediate page reload to page2.aspx(e.g., "window.location = 'page2.aspx'")

Note that the <form> tags in each of these pages have unique names and ids, and that the size of viewstate is 2-4K.

Jon Stalnaker
August 10, 2005

# re: Invalid ViewState

I'm glad this topic is beginning to be covered more often. In my scenario, we have a clustered server and changed the machinekey to identical values so that was covered, but we do recycle the application pool every 12 hrs, so I will take a look at changing that to non-peak hours.

It's been my experience that 99% of the users who receive this error are using the Mac PowerPC or mobile browsers. Rarely does a user who is running IE 6.0 encounter the error.

Ian
August 11, 2005

# re: Invalid ViewState

I too am having this problem ONLY with the Mac users. I've read that some proxies limit the size of hidden fields and I put in a fix I found at this link but it just changed the error so I pulled it out.

http://weblogs.asp.net/pwilson/archive/2003/08/21/24867.aspx

I've also noticed that it only appears to happen when doing a redirect (not a transfer).

Dave
September 08, 2005

# re: Invalid ViewState

We are getting bursts of about 12 post attempts 2 seconds apart which look as if they are malicious posts, triggering the view state error. In all cases no browser information is sent with the request. I have noticed this over about the last 2 months, and it is getting more frequent. It looks like the hacker is trawling all the links from our home page and trying to post to these pages - some of which should never be posted to. Anyone else seen this?

Jack
April 03, 2006

# re: Invalid ViewState

Hi we are seeing the same problem as Morgan Belford. As far as I can work out our scenario is as follows:

A user logins into the site they browse around. They leave the session idle and then return. Their session/authentication has expired so they are redirected to our login page to re-authenticate. The previous pages viewstate is also passed to the login page causeing it to fall on its face.

We see this with Safari/417.8 - Safari/417.92 and WebTV/2.5.9

I have yet to find a solution... :(

Bruce Hemmerich
May 26, 2006

# re: Invalid ViewState

Doesn't turning EnableViewStateMac off cause any security concerns? Aren't we talking about message authentication code?

I agree with Tim Farely's solution above.

I highly recommend everyone read (http://www.aspnetresources.com/articles/ViewState.aspx#) this excellent article about this exact problem.

Good luck.

Rick Strahl
May 26, 2006

# re: Invalid ViewState

Bruce, it depends of what you put into ViewState. Don't use ViewState you don't need to protect it <g>.

ViewState security makes sense in certain scenarios but in most I don't see what the fuss is about. Heck most of our apps POST data to the server that's not encrypted and you can do a lot more damage with that than with ViewState (again unless you put sensitive data into ViewState).

Ben Strackany
August 23, 2006

# re: Invalid ViewState

Apparently viewstate errors can also occur if you're using Server.Transfer, per

http://aspalliance.com/909.

Also, if your server is at an ISP, you can put a machineKey into the web.config instead. I have a machingeKey generator at

http://www.developmentnow.com/articles/machinekey_generator.aspx

if anyone needs one.

DotNetSlackers Latest ASP.NET News
October 11, 2006

# DotNetSlackers: Invalid ViewState

State Management
January 01, 2007

# ASP.NET Forums - ViewStateException Invalid ViewState

ASP.NET Forums
June 01, 2007

# ViewStateException Invalid ViewState - ASP.NET Forums

parwej
November 06, 2007

# re: Invalid ViewState

I am facing same problem. Safari users on Mac are getting Viewstate error.
I have used two methods to open a new window in which application runs.

Below is the C# code used my me.

Method 1:

Page.RegisterStartupScript("AppicationInNewWindow","<script language=javascript>OpenApp(url)</script>");

The OpenApp() is a javascript function which opens the Appication into new window using window.open.

Method 2:

Page.RegisterStartupScript("ChangeURL","<script language=javascript>window.location.href=url</script>");

In this method application is already opened in new window, so i have used window.location.href to change the url.

Both these methods are working fine for IE and Mozilla browsers. But Safari users get Invalid viewState error in Method 2. I have tried making EnableViewStateMac off for this particular page. But then page does not get postback event for first time. Please suggest any way to get rid of this error. Ur help would be greatly appreciated.

Stephanie
November 21, 2007

# re: Invalid ViewState

I too am getting the famous Invalid Viewstate error on my websites registration page. It only happens occassionally and I can not for the life of me reproduce it. I don't know if it is a browser issue or something else. The form is not that big and it is posted back to itself not another form. I do not have a server farm and have generated a key and put it in my machine.config, but I still get the error randomly. Any ideas would be greatly appreciated.

Grant
January 10, 2008

# re: Invalid ViewState

I have the same problem, but have found a simple fix. I also have been playing around with machine keys and so forth, to no avail. I didn't notice that the Message of the exception said "The client disconnected" until earlier today. What's happening is the the user is interrupting the postback (by hitting BACK, closing the browser, or whatever) so not all the data is getting sent back to the server. Thus ASP.NET is (rightly) throwing an exception.

I have an HTTP module that handles all unhandled exceptions, so putting something like this in the ErrorHandler should do the trick :

public void HandleError (object sender, EventArgs e) {
HttpContext context = HttpContext.Current;
if (theError.Message.IndexOf("The client disconnected") == -1)
//handle the error
else
\\ignore it
}

Hope that helps!

Jol Blazey
February 21, 2008

# re: Invalid ViewState

This link might be relevant.
http://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=101988

Back button:
Being a Java Spring developer also, this is the spring solution - pretty sure same rules apply: Back button problem is not a problem if the posted page does an http redirect to the success page. Then pressing back does not re-post, it really goes back. success page does an http GET ?id=savedid to show the results of the post for example.

Jol.

Matt
October 29, 2009

# re: Invalid ViewState

Mozilla browsers can get upset with ViewState because they try (especially FF) to cache the entire page including ViewState. If you have any ajax on the page this can mess things up. The following should resolve most issues...

protected void Page_Load(object sender, EventArgs e)
{
   if (Request.Browser.MSDomVersion.Major == 0) // Non IE Browser?)
   {
       Response.Cache.SetNoStore(); // No client side cashing for non IE browsers
   }
}

DeveloperJoint
November 19, 2009

# re: Invalid ViewState

Excellant solution..Thanks for sharing but i resolve the problem by setting EnableViewStateMac property to "off".

Helo
February 25, 2010

# re: Invalid ViewState

Setting EnableViewStateMac to false did not work for me.

Did anyone try changing the DOCTYPE in the page from XHtml to Html? I have read that this may also cause the Invalid Viewstate error for certain browsers:

http://www.31a2ba2a-b718-11dc-8314-0800200c9a66.com/2009/04/error-scriptresourceaxd-invalid.html

Perry Manole
February 17, 2011

# re: Invalid ViewState

I set EnableViewState and EnableViewStateMac to false and still get the error. It happens on a complex page with several Ajax UpdatePanels and can reproduce it every time. It only happens if I execute the partial post backs in a certain sequence. This is on IE8. Anyone have a solution for this?

Sandy
April 28, 2011

# re: Invalid ViewState

Rick, can the "viewstate verification failed. reason viewstate was invalid" error be caused by a defective router? We're seeing this error coming only from a single customer site. We aren't on a web farm, nor do we have any of the other conditions known to cause the error. If their router is dropping a few bytes, it would make sense that a large ViewState would be damaged from time to time.

Is there a good method to prove or disprove this hypothesis?

Rick Strahl
April 29, 2011

# re: Invalid ViewState

@Sandy - not sure how you can prove or disprove that. I think a defective router would be easy to detect as packets would be corrupt - it rarely happens that the incomplete data makes it through without getting detected as errors.

I would suspect other things first. ViewState corruption can occur due to timeouts as well as AJAX stuff in pages messing with ViewState'd content. A lot of viewstate errors come from robots that access pages with cached data that has expired or is just plain invalid.

Rick Strahl's Weblog